@auth doesn't filter on ID

Issues Dgraph
7

Looks like it was discussed here: @auth rules filtering on id allows access to any resourse

As a workaround: if you have another edge that serves as a UID in Consumer, you can write the rule to restrict on that edge. For instance:

type Consumer @auth(
    query: {
      rule: """
      query ($NAME: String!) {
        queryConsumer(filter: {name: {eq: $NAME}}) {
          id
        }
      }
      """
    }
  ) {
  id: ID!
  name: String! @search(by: [exact])
}

I’ll have a look to see where this issue is in the backlog.

1 Like